@holo-js/security 0.1.4 → 0.1.6

package/dist/{chunk-3J5QRTPZ.mjs → chunk-EWQKJSFA.mjs}

@@ -1,5 +1,8 @@
 // src/contracts.ts
-import { normalizeSecurityConfig } from "@holo-js/config";
+import {
+  normalizeCorsConfig,
+  normalizeSecurityConfig
+} from "@holo-js/config";
 var SecurityCsrfError = class extends Error {
   status = 419;
   constructor(message = "CSRF token mismatch.") {
@@ -46,23 +49,17 @@ function normalizeLimiterAttempts(value, label) {
   }
   return value;
 }
-function normalizeLimiterWindowSeconds(value, label) {
-  if (!Number.isInteger(value) || value < 1) {
-    throw new TypeError(`[@holo-js/security] ${label} must be an integer greater than or equal to 1.`);
-  }
-  return value;
-}
 var limit = Object.freeze({
   perMinute(maxAttempts) {
     return new PendingSecurityLimiterDefinition(
       normalizeLimiterAttempts(maxAttempts, "Rate limiter maxAttempts"),
-      normalizeLimiterWindowSeconds(60, "Rate limiter decaySeconds")
+      60
     );
   },
   perHour(maxAttempts) {
     return new PendingSecurityLimiterDefinition(
       normalizeLimiterAttempts(maxAttempts, "Rate limiter maxAttempts"),
-      normalizeLimiterWindowSeconds(3600, "Rate limiter decaySeconds")
+      3600
     );
   }
 });
@@ -116,6 +113,7 @@ function defineRateLimiter(definition) {
 function defineSecurityRuntimeBindings(bindings) {
   return Object.freeze({
     config: normalizeSecurityConfig(bindings.config),
+    cors: normalizeCorsConfig(bindings.cors),
     rateLimitStore: bindings.rateLimitStore,
     csrfSigningKey: bindings.csrfSigningKey,
     defaultKeyResolver: bindings.defaultKeyResolver
@@ -138,8 +136,7 @@ function createRedisRateLimitStoreConfig(config = {}) {
 }
 var securityInternals = {
   PendingSecurityLimiterDefinition,
-  normalizeLimiterAttempts,
-  normalizeLimiterWindowSeconds
+  normalizeLimiterAttempts
 };
 
 export {

package/dist/chunk-FUOZWKHK.mjs

@@ -0,0 +1,79 @@
+// src/client-config.ts
+var SECURITY_CLIENT_CONFIG_COOKIE = "HOLO-CSRF-CONFIG";
+var DEFAULT_SECURITY_CLIENT_CONFIG = Object.freeze({
+  csrf: Object.freeze({
+    field: "_token",
+    cookie: "XSRF-TOKEN"
+  })
+});
+function safeDecodeCookieValue(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return void 0;
+  }
+}
+function parseCookieHeader(header) {
+  if (!header) {
+    return Object.freeze({});
+  }
+  const entries = header.split(";").map((segment) => segment.trim()).filter(Boolean).map((segment) => {
+    const separator = segment.indexOf("=");
+    if (separator <= 0) {
+      return void 0;
+    }
+    const name = safeDecodeCookieValue(segment.slice(0, separator));
+    const value = safeDecodeCookieValue(segment.slice(separator + 1));
+    return name && typeof value === "string" ? [name, value] : void 0;
+  }).filter((entry) => typeof entry !== "undefined");
+  return Object.freeze(Object.fromEntries(entries));
+}
+function isSecurityClientConfig(value) {
+  return !!value && typeof value === "object" && !!value.csrf && typeof value.csrf.field === "string" && typeof value.csrf.cookie === "string";
+}
+function getDefaultSecurityClientConfig() {
+  return DEFAULT_SECURITY_CLIENT_CONFIG;
+}
+function createSecurityClientConfig(config) {
+  return Object.freeze({
+    csrf: Object.freeze({
+      field: config.csrf.field,
+      cookie: config.csrf.cookie
+    })
+  });
+}
+function serializeSecurityClientConfig(config) {
+  return JSON.stringify(config);
+}
+function readSecurityClientConfigFromCookies(cookieHeader) {
+  const raw = parseCookieHeader(cookieHeader)[SECURITY_CLIENT_CONFIG_COOKIE];
+  if (!raw) {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!isSecurityClientConfig(parsed)) {
+      return void 0;
+    }
+    return Object.freeze({
+      csrf: Object.freeze({
+        field: parsed.csrf.field,
+        cookie: parsed.csrf.cookie
+      })
+    });
+  } catch {
+    return void 0;
+  }
+}
+var securityClientConfigInternals = {
+  parseCookieHeader
+};
+
+export {
+  SECURITY_CLIENT_CONFIG_COOKIE,
+  getDefaultSecurityClientConfig,
+  createSecurityClientConfig,
+  serializeSecurityClientConfig,
+  readSecurityClientConfigFromCookies,
+  securityClientConfigInternals
+};